PowerShell Disable or Remove ETW Trace Sessions

Flags PowerShell commands that remove or disable ETW trace providers to impair Windows telemetry.

FreeReviewedSigma · High · v4

Product: windows
Category: ps_script
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-06-28
Updated: 2026-10-13

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1070Indicator Removal
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags PowerShell script block content that removes ETW trace providers or modifies a provider’s Enable property to disable tracing. Such activity can reduce or impair visibility into system and process activity, which attackers may use to evade monitoring. It relies on Script Block Logging telemetry capturing PowerShell cmdlet usage in script block text, matching specific ETW-related cmdlet strings and provider enable values.

Reporting behind it

Related detections9 linkedT1685 — drag to rearrange

Suspicious Clearing of hosts.deny Access Restrictions on Linux

Windows Process Creation: ETW Trace Evasion via wevtutil, logman, and PowerShell

Malicious Windows Defender Disablement via MpCmdRun RemoveDefinitions

Malicious Unsigned VIB Installation on ESXi Host via esxcli (via process_creation)

Suspicious In-Memory PowerShell Execution from Web Server via Automation Assembly (via image_load)

Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)

Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)

Suspicious EDRKillShifter Vulnerable Driver Load from User Temp Directory (via image_load)

Malicious AuKill EDR Killer Kernel Driver Load via Process Explorer Driver (via image_load)

PowerShell Disable or Remove ETW Trace Sessions

Pivot detection · T1685 · 9 related

Changelog

v4
Candidate ingested via manual entry.2026-10-13
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

powershell-disables-or-removes-etw-trace-providers-via-etw-cmdlets-115fdba9

title: PowerShell Disable or Remove ETW Trace Sessions
id: a77a4d4e-e46e-42af-b4b8-1590fe04ce8f
related:
  - id: a238b5d0-ce2d-4414-a676-7a531b3d13d6
    type: derived
  - id: 115fdba9-f017-42e6-84cf-d5573bf2ddf8
    type: derived
status: test
description: This rule flags PowerShell script block content that removes ETW trace providers or modifies a provider’s Enable property to disable tracing. Such activity can reduce or impair visibility into system and process activity, which attackers may use to evade monitoring. It relies on Script Block Logging telemetry capturing PowerShell cmdlet usage in script block text, matching specific ETW-related cmdlet strings and provider enable values.
references:
  - https://medium.com/palantir/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_etw_trace_evasion.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2026-10-12
tags:
  - attack.stealth
  - attack.defense-impairment
  - attack.t1070
  - attack.t1685
  - car.2016-04-002
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_pwsh_remove:
    ScriptBlockText|contains: "Remove-EtwTraceProvider "
  selection_pwsh_set_hex:
    ScriptBlockText|contains|all:
      - "Set-EtwTraceProvider "
      - "0x11"
  selection_pwsh_set_dec:
    - ScriptBlockText|contains|all:
        - "Set-EtwTraceProvider "
        - " 17"
    - ScriptBlockText|contains|all:
        - "Set-EtwTraceProvider "
        - “'17'”
    - ScriptBlockText|contains|all:
        - "Set-EtwTraceProvider "
        - ”17”
  condition: 1 of selection_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL